[FFmpeg-devel] [PATCH 1/4] avcodec/jpegxl_parser: ensure input padding is zeroed

[Andreas Rheinhardt]

Kacper Michajłow:
> Fixes use of uninitialized value, reported by MSAN.
> 
> Found by OSS-Fuzz.
> 
> Signed-off-by: Kacper Michajłow <kasper93 at gmail.com>
> ---
>  libavcodec/jpegxl_parser.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
> index 8c45e1a1b7..f833f844c4 100644
> --- a/libavcodec/jpegxl_parser.c
> +++ b/libavcodec/jpegxl_parser.c
> @@ -1419,6 +1419,7 @@ static int try_parse(AVCodecParserContext *s, AVCodecContext *avctx, JXLParseCon
>          }
>          cs_buffer = ctx->cs_buffer;
>          cs_buflen = FFMIN(sizeof(ctx->cs_buffer) - AV_INPUT_BUFFER_PADDING_SIZE, ctx->copied);
> +        memset(ctx->cs_buffer + cs_buflen, 0, AV_INPUT_BUFFER_PADDING_SIZE);
>      } else {
>          cs_buffer = buf;
>          cs_buflen = buf_size;

This is very strange: The buffer here is part of the parser's private
context and this is zeroed initially. So it should never contain
uninitialized values.

- Andreas